docs: propose guest foreground work and restart notices

[vincentkoc]

What Problem This Solves

Guest users need a clear outcome when a Gateway restart interrupts their work. Automatically resuming that work requires authority and recovery machinery that the first guest experience does not need.

Why This Change Was Made

Propose bounded foreground guest turns, a persistent stopped-after-restart notice, and a fresh authorized request to continue in the same thread. Reuse existing session, transcript, and sandbox registry SQLite payloads: no new table, column, database, sidecar, or schema-version bump. The allocation marker retirementPolicy: 'foreground-owner' keeps cleanup with its original owner until whole-process shutdown is confirmed.

User Impact

This is a design proposal only. History remains available, interrupted guest work never resumes automatically, and staff behavior stays unchanged. Durable jobs and unqualified detached execution remain outside the initial guest profile. Generic cleanup retains marked or uncertain allocations. Older builds can ignore both markers, so incompatible downgrades require quiescing and reconciliation under compatible code first. Schema compatibility alone does not make rollback safe. Runtime containment and engine qualification remain implementation requirements.

Related proposals: #70 and #71.

Evidence

• Compared the design against frozen OpenClaw source b6bd69d6e85f9a2d6ae5f0bf15e5fcfe6dd88490; exact owner links are in the RFC.
• Checked required template sections, draft metadata, frozen source links, public privacy, and whitespace.
• Technical prose lint passes with zero hard findings; retained advisory wording preserves uncertainty about external effects.
• Independent source-informed design review completed before final publication.
• No runtime code, schema, server configuration, or deployment changes. End-to-end lifecycle proof belongs to the implementation.

The required maintainer-discussion thread is pending. This RFC remains draft and unmerged, with no implementation issue until acceptance.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR proposes bounded guest turns, persistent restart-interruption notices, fresh authorization to continue, and owner-controlled allocation cleanup.

Example: A Gateway restarts while guest request guest-run-42 is executing.

• Before: Existing recovery mechanisms do not establish the proposed guest-specific prohibition on resuming that request.
• After: The proposed policy records a terminal outcome and one persistent notice; a new authorized request can continue after resource-stop checks.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A coherent, carefully bounded documentation proposal with no concrete defect found; runtime implementation is outside this patch.
Proof confidence	🌊 off-meta tidepool	Not applicable: This PR adds only a draft design document; runtime, authority-chain, containment, and upgrade demonstrations are explicitly deferred to implementation.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Docs · Worth it: Yes
User problem: Guests need a visible outcome when restart interrupts their work and a safe way to continue without silently restoring old authority.
Reason: The maintainer-authored proposal provides a distinct, concrete guest contract and openly bounds its implementation claims; formal RFC acceptance remains governed by the repository lifecycle.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep this PR open as a substantive, maintainer-authored draft RFC that is absent from main; no concrete patch defect was found.

Priority: P3
Reviewed head: 0e4434284515c4cc38cb615db8d677bbf848c85f

Before merge

• Complete next step - Create and link the required maintainer-discussion thread; after RFC acceptance, designate the implementation issue and update status and issue metadata before merge.

Findings

None.

Agent review details

How this fits together

This design repository records proposed contracts for OpenClaw; the RFC connects authenticated guest admission to execution, persisted recovery state, transcript notices, and sandbox retirement.

flowchart TD
A[Authenticated guest request] --> B[Admission and current policy]
B --> C[Bounded foreground turn]
C --> D[Persisted run decision]
D --> E[Restart lifecycle settlement]
E --> F[Terminal outcome and thread notice]
C --> G[Original allocation owner]
G --> H[Verified shutdown and cleanup]

Loading

Technical review

Best possible solution:

Complete the repository's discussion and acceptance lifecycle, then implement the qualified guest policy through existing admission, lifecycle, storage, and sandbox owners.

Do we have a high-confidence way to reproduce the issue?

This PR proposes a new guest policy rather than repairing a reproduced repository bug; no target runtime was executed.

Is this the best way to solve the issue?

The design uses existing owners and explicitly addresses replay, current authorization, uncertain effects, containment, and rollback without claiming those implementation requirements are already proven.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning medium; reviewed against 967d9aac7472.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned introduction adds only the 347-line RFC; it changes no runtime, workflow, or storage implementation, and the default branch remains at the supplied main SHA. (rfcs/0039-guest-foreground-work-and-restart-notices.md:1, 0e4434284515)
• RFC lifecycle: README requires a maintainer-discussion thread and forbids merging a draft RFC; acceptance precedes implementation-issue metadata and merge. (README.md:81, 967d9aac7472)
• Recorded draft intent: The MEMBER-authored body says the discussion thread is pending; the author's comment confirms that the reviewed head remains draft pending discussion and acceptance. (0e4434284515)
• Explicit qualification boundaries: The RFC distinguishes logical termination from physical shutdown, blocks unsafe resource reuse and downgrade, and reserves authenticated lifecycle and upgrade proof for implementation. (rfcs/0039-guest-foreground-work-and-restart-notices.md:263, 0e4434284515)
• Authoritative source contract: The RFC explicitly uses frozen OpenClaw source as its design reference, establishing dependency relevance; the cited recovery owner combines guarded lifecycle settlement and a transcript notice in one SQLite transaction. (src/agents/main-session-recovery/main-session-restart-recovery-failure.ts:130, b6bd69d6e85f)
• Bounded replay bookkeeping: The referenced terminal-source owner caps retained run IDs at 64, supporting the RFC's explicit requirement to recognize an additional exact transcript receipt without claiming indefinite deduplication. (src/config/sessions/restart-recovery-state.ts:16, 8c001ebde933)

Likely related people:

• kevinlin-openai: Raw commit af708f0 adds rfcs/0027-openclaw-enterprise.md:102 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: af708f0ddb6f; files: rfcs/0027-openclaw-enterprise.md)

Labels

Label changes:

• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

• P3: This is a documentation-only design proposal with no immediate runtime change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (4 earlier review cycles)

• reviewed 2026-09-22T12:59:06.874Z sha 228b602 :: blocked before merge. :: none
• reviewed 2026-09-22T13:30:59.691Z sha a36dc5d :: blocked before merge. :: none
• reviewed 2026-09-23T04:23:53.133Z sha 0e44342 :: blocked before merge. :: none
• reviewed 2026-10-06T20:52:10.643Z sha 0e44342 :: blocked before merge. :: none

Reviewed October 12, 2026, 10:40 AM ET / 14:40 UTC (Revision 5).

[vincentkoc]

@clawsweeper re-review

Please review exact head 0e44342. The RFC remains draft pending maintainer discussion and acceptance.

[clawsweeper]

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event exact_review_queue).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/35818280507
• Updated: 2026-09-23T04:25:55.379Z